VPC

A VPC is your own private network inside AWS. When you launch resources like EC2 instances or RDS databases, they live inside a VPC. You control the IP address ranges, how traffic is routed, and what can communicate with what.

Why Networking Matters in AWS

AWS is a shared cloud — millions of customers run workloads on the same physical infrastructure. A VPC is how AWS gives you an isolated slice of that infrastructure where your resources can communicate privately without being exposed to other customers or to the internet unless you explicitly allow it.

The Building Blocks

Subnets divide your VPC's IP address range into smaller segments, each tied to a specific Availability Zone. A public subnet has a route to the internet via an Internet Gateway — instances there can have public IPs. A private subnet has no direct internet route — instances there can only be reached from within your network, which is where you put databases, application servers, and anything else that shouldn't be directly internet-facing.

Internet Gateway (IGW) — the door between your VPC and the public internet. Attach one to your VPC, and resources in public subnets can send and receive internet traffic.

Route Tables — every subnet has a route table that tells traffic where to go. A public subnet's route table sends 0.0.0.0/0 (everything) to the IGW. A private subnet's route table sends 0.0.0.0/0 to a NAT Gateway (for outbound only) or has no internet route at all.

Security Groups — virtual firewalls attached to individual resources (EC2 instances, RDS, Lambda). They control which ports and protocols can send traffic in and out. Security groups are stateful: if you allow inbound traffic, the response is automatically allowed back out.

Network ACLs — firewalls at the subnet level. They control traffic entering and leaving the subnet itself and are stateless (you must explicitly allow both inbound and outbound). Most teams use security groups for fine-grained control and keep NACLs as a coarse backstop.

A Typical Architecture

Most production setups use at least two subnet tiers. A public subnet holds a load balancer that accepts internet traffic. A private subnet holds application servers that talk to the load balancer but are not directly reachable from the internet. A second private subnet holds databases that only the application servers can reach. This layered approach limits what an attacker can reach even if they compromise one layer.